Skip to contentApache Software Foundation Airflow Fab Provider vulnerabilities
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedCVE-2026-864668.1 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessCVE-2026-823107.2 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsCVE-2026-864629.1 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseCVE-2026-823119.8 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassCVE-2026-751569.1 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)CVE-2026-59243Public exploit9.8 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)CVE-2026-592458.1 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/tokenCVE-2026-46745Fix available5.3 Medium
- apache software foundation airflow fab provider, apache apache-airflow-providers-fab +1 moreApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliCVE-2024-45033Fix available8.1 High